Turn on Protected Mode

Purpose

Show registry keys (2)

• HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500
• HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500

This policy controls Protected Mode for the Restricted Sites security zone (zone 4). Protected Mode limits the registry and file-system locations to which content handled by Internet Explorer can write. These restrictions reduce the potential impact of an exploited browser or website vulnerability.

2500 is a REG_DWORD value. A value of 0 turns Protected Mode on, while 3 turns it off. The HKLM location represents the computer policy and the HKCU location represents the user policy. When the policy has an effective configured state, the user cannot override that state. If the policy is not configured, the user can change the Protected Mode setting.

This policy does not assign websites to a security zone. It affects only content that is already classified as belonging to the Restricted Sites zone.

Notes

Security

With Protected Mode enabled, web content processed by Internet Explorer has less ability to modify higher-integrity file-system and registry locations. This containment limits the changes that compromised content or an exploited browser extension can make.

Turning Protected Mode off removes this protection layer from the Restricted Sites zone. Other zone security settings remain in effect, but they do not provide the same write restrictions. Protected Mode is also not a complete defense against browser exploitation and is distinct from Enhanced Protected Mode, which is controlled separately.

Possible side effects

Legacy web applications, browser extensions, and ActiveX components can fail or behave differently if they depend on direct write access to locations unavailable under Protected Mode. User-initiated operations such as saving a file can be handled through a higher-privilege broker process.

Notes

The standalone Internet Explorer 11 desktop application is retired or permanently disabled on certain Windows versions. This setting can remain relevant to supported legacy Internet Explorer environments and to pages running in Microsoft Edge IE mode. Microsoft documents that IE mode supports Internet Explorer policies affecting security-zone settings and Protected Mode.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneTurnOnProtectedMode

Microsoft Learn: What is Internet Explorer (IE) mode?

See also

• Entry in the reference